Allocating memory access control policies

Abstract

Enabling access control caches for co-processors to be charged using a VMX-nonroot instruction. As a result a transition to VMX-root is not needed, saving the cycles involved in such a transition.

What is claimed is: 
     
       1. A method comprising:
 enabling access control context to be changed, by a hardware computer processor, using an instruction in virtualization mode that is not fully privileged and without transitioning to a fully privileged mode only accessible by a virtual machine monitor, by changing a memory map for a device while limiting access to other portions of the memory. 
 
     
     
       2. The method of  claim 1  including setting up access tables with a unique root pointer for a set of permissions. 
     
     
       3. The method of  claim 2  including assigning the set of permissions to a context. 
     
     
       4. The method of  claim 3  including switching root pointers. 
     
     
       5. The method of  claim 3  including flushing permission caches. 
     
     
       6. The method of  claim 1  including offloading kernel scheduling to a graphics processor. 
     
     
       7. The method of  claim 6  including enabling the graphics processor to switch root pointers. 
     
     
       8. The method of  claim 1  including setting up a context for a co-processor in the mode that is not fully privileged. 
     
     
       9. The method of  claim 8  including sending the context to the fully privileged mode. 
     
     
       10. The method of  claim 9  including extracting access control information for the context in the fully privileged mode. 
     
     
       11. A non-transitory computer readable medium storing instructions to enable a hardware computer processor to perform:
 enabling access control context to be changed using an instruction in virtualization mode that is not fully privileged and without transitioning to a fully privileged mode only accessible by a virtual machine monitor, by changing a memory map for a device while limiting access to other portions of the memory. 
 
     
     
       12. The medium of  claim 11  further storing instructions to perform a method including setting up access tables with a unique root pointer for a set of permissions. 
     
     
       13. The medium of  claim 12  further storing instructions to perform a method including assigning the set of permissions to a context. 
     
     
       14. The medium of  claim 13  further storing instructions to perform a method including switching root pointers. 
     
     
       15. The medium of  claim 13  further storing instructions to perform a method including flushing permission caches. 
     
     
       16. The medium of  claim 11  further storing instructions to perform a method including offloading kernel scheduling to a graphics processor. 
     
     
       17. The medium of  claim 16  further storing instructions to perform a method including enabling the graphics processor to switch root pointers. 
     
     
       18. The medium of  claim 11  further storing instructions to perform a method including setting up a context for a co-processor in the mode that is not fully privileged. 
     
     
       19. The medium of  claim 18  further storing instructions to perform a method including sending the context to the mode that is fully privileged. 
     
     
       20. The medium of  claim 19  further storing instructions to perform a method including extracting access control information for the context in the mode that is fully privileged. 
     
     
       21. An apparatus comprising:
 a hardware computer processor to enable access control context to be changed using an instruction in virtualization mode that is not fully privileged and without transitioning to a fully privileged mode only accessible by a virtual machine monitor, by changing a memory map for a device while limiting access to other portions of memory; and 
 a hardware computer co-processor coupled to said processor. 
 
     
     
       22. The apparatus of  claim 21  said processor to set up access tables with a unique root pointer for a set of permissions. 
     
     
       23. The apparatus of  claim 22  said processor to assign the set of permissions to a context. 
     
     
       24. The apparatus of  claim 23  said processor to switch root pointers. 
     
     
       25. The apparatus of  claim 23  said processor to flush permission caches. 
     
     
       26. The apparatus of  claim 21  said processor to offload kernel scheduling to the co-processor that is a graphics processor. 
     
     
       27. The apparatus of  claim 26  said processor to enable the co-processor to switch root pointers. 
     
     
       28. The apparatus of  claim 21  said processor to set up a context for the co-processor in the mode that is not fully privileged. 
     
     
       29. The apparatus of  claim 28  said processor to send the context to the fully privileged mode. 
     
     
       30. The apparatus of  claim 29  said processor to extract access control information for the context in the fully privileged mode.